reading-notes

These are my reading notes for Code Fellows

---

Project maintained by taegorov Hosted on GitHub Pages — Theme by mattgraham

Link Home:

Home

Bearer Authorization

• Write the following steps in the correct order:

1. Register your application to get a client_id and client_secret
2. Ask the client if they want to sign in via a third party
3. Make a request to a third-party API endpoint
4. Receive access token
5. Receive authorization code
6. Make a request to the access token endpoint
7. Redirect to a third party authentication endpoint

• What can you do with an authorization code?

The client exchanges this temporary code for an access token. (source)

• What can you do with an access token?

These represent the authorization of a some app to access certain pieces of a user’s data (a password, for example). (source)

• What’s a benefit of using OAuth instead of your own basic authentication?

Super secure, widely used, and most people have one of the log in methods already.

Document the following Vocabulary Terms:

• Client ID

The client_id is a public identifier for apps. Even though it’s public, it’s best that it isn’t guessable by third parties, so many implementations use something like a 32-character hex string. (source)

• Client Secret

A client secret is a secret known only to your application and the authorization server. (source)

• Authentication Endpoint

Endpoint authentication is a security mechanism designed to ensure that only authorized devices can connect to a given network, site or service. (source)

• Access Token Endpoint

The /oauth/token endpoint is used by the application in order to get an access token or a refresh token. (source)

• API Endpoint

In simple terms, an API endpoint is the point of entry in a communication channel when two systems are interacting. It refers to touchpoints of the communication between an API and a server. The endpoint can be viewed as the means from which the API can access the resources they need from a server to perform their task. An API endpoint is basically a fancy word for a URL of a server or service. (source)

• Authorization Code

After the user returns to the application via the redirect URL, the application will get the authorization code from the URL and use it to request an access token. This request will be made to the token endpoint. (source)

• Access Token

Access tokens are used in token-based authentication to allow an application to access an API. The application receives an access token after a user successfully authenticates and authorizes access, then passes the access token as a credential when it calls the target API. The passed token informs the API that the bearer of the token has been authorized to access the API and perform specific actions specified by the scope that was granted during authorization. (source)